The bug occurs in the dpaa2_switch_rx() function when an error happens while processing network packets. Rather than freeing the frame descriptor with free_pages(), the code calls dpaa2_switch_free_fd(), a function intended for transmit descriptors. Since no socket buffer has been allocated, this call attempts to free an invalid or NULL skb, which can corrupt kernel memory or trigger a crash. The vulnerability is an example of an improper error‑handling path leading to memory corruption (CWE‑763).

Any Linux kernel installation that builds and enables the dpaa2 switch subsystem before the committed changes is affected. Since the kernel commit that fixes the error path is integrated in the mainline tree, users running kernel versions prior to the commit that contain the dpaa2-switch driver are at risk. The kernel release does not provide a specific affected version list; therefore every kernel that compiles the driver and has not yet incorporated the fix is vulnerable.

The CVSS score of 7.5 classifies the issue as high severity. The EPSS score of less than 1 % indicates a low likelihood of exploitation in current data samples, but does not eliminate potential risk. The vulnerability is not yet listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. An attacker with network access to a device that runs the dpaa2 switch driver could send crafted packets that exercise the faulty error path, potentially leading to a kernel crash and denial of service. The description does not explicitly state the required privilege level; however, we infer that local or privileged access may be necessary to orchestrate the error conditions, or that a remote attacker can trigger the failure via network traffic.